Attack Lab

Testnet simulation

Forges a WeakBridge message with the bridge's single verifier key and no matching burn. It reproduces the effect of the Kelp forgery, a credit with no debit, across three testnets.

Flow B, step by step

1Forge a WeakBridge message, pending
Its single verifier key signs a credit. HomeEscrowAdapter releases 116,500 kETH on Ethereum Sepolia.
2W1 searches for the matching debit, pending
The Released log trigger fires. No Burned debit with this message id exists on any remote chain.
3BROKEN written to all three ledgers, pending
Same CRE run. The evidence hash lands in ConservationLedger on every chain.
4W3 applies quarantine, pending
CCIP lanes for kETH freeze, the attacker is tainted, the Conservation Feed answers BROKEN.
5The attacker bridges to Base through CCIP, pending
Every cell's Judge returns FAIL TOKEN_BROKEN. The message never executes.
6Guard and lending market hold, pending
KirchhoffGuard blocks the tainted sender. borrow() reverts CollateralBroken().
7W2 confirms the Loop Rule deficit, pending
The next epoch reads every chain at pinned blocks: Δ = −116,500 kETH.

Circuit

Balance

Verdicts